@mutmutco/cursor-plugin 4.1.19 → 4.2.0

package/.cursor-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mmi",
-  "version": "4.1.19",
+  "version": "4.2.0",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and organisation gates for Cursor.",
   "author": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cursor-plugin",
-  "version": "4.1.19",
+  "version": "4.2.0",
   "description": "MMI workflow skills and organisation gates for Cursor.",
   "author": {
     "name": "MMI Future",

package/skills/bootstrap/SKILL.md

@@ -429,9 +429,10 @@ collaborator list + the per-branch allowlist are the record — no separate rost
   central workflows, so `MMI_APP_ID` / `MMI_APP_PRIVATE_KEY` live only on the Hub — a product repo seeds no
   App var/secret.
 - **Issue templates** — seed `.github/ISSUE_TEMPLATE/` (Bug · Feature · Task + `config.yml`).
-- **Merge settings (org canon)** — every repo: auto-merge on, squash on, delete-branch-on-merge on, so a
-  green allowlisted PR can land itself and never leaves a dead branch:
-  `gh api -X PATCH repos/$OWNER/$REPO -f allow_auto_merge=true -f allow_squash_merge=true -f delete_branch_on_merge=true`
+- **Merge settings (org canon)** — every repo: auto-merge on, squash on, automatic merged-branch deletion
+  off. A merged remote branch survives until delayed cleanup proves no open PR still uses it as a base
+  (#5789); deleting it at merge can irreversibly close stacked PRs:
+  `gh api -X PATCH repos/$OWNER/$REPO -f allow_auto_merge=true -f allow_squash_merge=true -F delete_branch_on_merge=false`
 - **Cursor environment** — `.cursor/environment.json` is retired org-wide (#2501): it caused Cursor to
   auto-spawn cloud agents nobody asked for. Bootstrap no longer seeds it and no
   repo should carry a tracked copy.
@@ -450,9 +451,7 @@ collaborator list + the per-branch allowlist are the record — no separate rost
   Step-0 axes (class, project-type, deploy-model). Do **not** write the release track, board number, or deploy
   coords as a value — the templates point at `mmi-cli oracle org project get` (registry SSOT, never copied, so it cannot drift).
   Do not write `AGENTS.md` / `CLAUDE.md` — these are developer-owned, gitignored agent guides, never a bootstrapped repo file (the `mmi-no-agent-files-org` ruleset blocks committing them).
-- **`docs/index.md` is an optional generated routing index (#3545 / Hub#4133).** Agent entrypoints prefer
-  `mmi-cli oracle repo-index search` + compute-at-read CLI over living prose under `docs/`. Apply may still create
-  `docs/index.md` once for link routing; it never rewrites it. Once the repo has docs of its own,
+- **`docs/index.md` is an optional generated routing index (#3545).** Apply may create `docs/index.md` once for link routing; it never rewrites it. Once the repo has docs of its own,
   `mmi-cli oracle docs index --write` owns the routing artifact and `--check` gates drift — it is not product
   current-state SSOT. Decision records under `docs/decisions/` remain append-only *why*.
 - **Push the mandated fill past the active ruleset (#1807).** Deployable repos activate

package/skills/bootstrap/seeds/README.template.md

@@ -18,11 +18,10 @@ access runbook → [repo-access](https://github.com/mutmutco/MMI-Hub/blob/develo
 
 Read this section at the start of agent work in this repo.
 
-- **Structure search:** `mmi-cli oracle repo-index search <path|symbol|meaning>` — Hub cloud pointer hits
-  (Hub#4133). Prefer this over inventing wiki pages or trusting stale inventories under `docs/`.
+- **Structure search:** JervCode indexes locally (Jerv-JervCode#2506). Verify results against cited source before acting.
 - **Durable WHY:** `docs/decisions/` — one file per decision, prose only for what was chosen and
   rejected; never a description of current state. Do not maintain living current-state under `docs/`.
-- **Current state:** code + compute-at-read CLI (`mmi-cli oracle org project get`, `board`, `status`,
+- **Current state:** code + live CLI (`mmi-cli oracle org project get`, `board`, `status`,
   `org schedules`, …) — registry facts, resolved live. Optional generated `docs/index.md` is a
   **routing** index only (`mmi-cli oracle docs index --check`), not product truth.
 - **GitHub wikis are retired org-wide** — this repo does not publish to a `.wiki.git`; do not create one.

package/skills/mmi-resume/SKILL.md

@@ -96,8 +96,7 @@ item with its claim command. Then stop. The user drives — claim, continue, or
 
 ## Current-state doors (Hub#4120)
 
-When answering “what is true now”, **ask the CLI**, not committed markdown inventories or weekly
-janitor prose. Catalog: `docs/Architecture/compute-at-read.md` (in MMI-Hub).
+When answering “what is true now”, **ask the CLI**, not committed markdown inventories or weekly janitor prose.
 
 | Ask | Verb |
 | --- | --- |
@@ -106,12 +105,6 @@ janitor prose. Catalog: `docs/Architecture/compute-at-read.md` (in MMI-Hub).
 | Registry / projects | `mmi-cli oracle org project list\|get` |
 | Board | `mmi-cli oracle board read` / `mmi-cli oracle next` |
 | Docs index freshness | `mmi-cli oracle docs index --check` |
-| Path / symbol / meaning pointers | `mmi-cli oracle repo-index search <q>` (Hub cloud; `--semantic` optional) |
-
-**Code orientation after a handoff (#5420):** a memory handoff orients by story, not by structure. Route
-cross-repo “where does X live / how does Y flow” questions through `mmi-cli oracle find <q>` (semantic) or
-`mmi-cli oracle repo-index search <q>` (hybrid) as the first-class step — before trusting recall or grepping a
-host-native index — and open the cited source to verify a pointer hit before acting on it.
 
 ## Notes
 

package/skills/onboard/SKILL.md

@@ -55,23 +55,6 @@ Close with one grounding line: gates green (or the one gate to fix), and the sin
 usually `mmi-cli oracle board claim <n>` for the recommended item, or the readiness fix if a gate is red. Don't
 claim on the user's behalf; let them take the first item when ready.
 
-## Step 2b — structure door (compute-at-read)
-
-Before treating `docs/**` as current-state, teach the Hub door (Hub#4133 / #4148):
-
-```bash
-mmi-cli oracle repo-index search <path-or-symbol-or-meaning>   # Hub cloud pointers (default)
-mmi-cli oracle repo-index search "where …" --semantic          # BGE meaning over embeddings
-mmi-cli oracle repo-index status --cloud                        # is the estate index live?
-```
-
-Host indexes (Cursor / Kilo) stay local helpers; **Hub `repo-index` is the org SSOT structure door**.
-After any memory handoff, cross-repo code-orientation questions go through `mmi-cli oracle find <q>` (semantic)
-or the `repo-index search` door above as the first-class step (#5420), and every pointer hit gets verified
-against the cited source before you act on it. Living current-state still comes from live verbs
-(`org schedules`, `board read`, …) — see `docs/Architecture/compute-at-read.md`. Do not invent wiki prose
-from pointer hits.
-
 ## Notes
 
 - `/onboard` is the first-session, readiness-first wrapper. Once a repo is known-good, `/mmi-resume` is the

package/skills/release/SKILL.md

@@ -191,8 +191,9 @@ before any branch/tag mutation (#5666).** They read the repo's expected CI npm f
 (when the infra gate's exact node pin maps to a bundled npm, e.g. node 24.19.0 → npm 11.17.0) or, when
 gate.yml only declares a floating node major with no bundled npm, from the publish workflow's explicit npm pin
 (e.g. `npx --yes npm@11.17.0 pack` in `publish.yml`). Local `npm -v` must match that npm **major**; a
-mismatch refuses `--apply` with an align-local-npm remedy — the same class of failure the fold-failure notes
-below describe, but caught before a wasted apply.
+mismatch refuses `--apply` before any repository write. The receipt gives the supported npm-only repair
+(`npm install -g npm@<exact CI version>`), the `node -v && npm -v` verification, and tells you to rerun the
+same release command. This preserves Node and avoids routing a machine-global mutation through the train.
 
 **A local `npm ci` failure during the fold on a lockfile CI already accepted is an npm-major mismatch, not a
 bad lockfile (#4578).** Before touching the lockfile, compare toolchains:
@@ -320,8 +321,7 @@ Scheduled docs-janitor / wiki-keeper / living-docs freshness passes are **retire
 The release train does **not** open docs-only PRs, wait on README/architecture auto-merges, or
 treat prose refresh as a gate.
 
-Current state is compute-at-read + the estate repo-index (`mmi-cli oracle repo-index search`,
-`mmi-cli oracle org project`, board/schedules verbs). Durable WHY stays in `docs/decisions/`.
+Current state comes from code and live CLI verbs. Durable WHY stays in `docs/decisions/`.
 If shipping code made a hand-written surface wrong, fix it on `development` as an ordinary PR
 **outside** the train — never as a release Step.
 
@@ -574,12 +574,7 @@ correct). Read the model from the registry (`mmi-cli oracle org project get {own
 - **repository-owned serverless / registry-publish** (e.g. Jerv-PowerTools' `Deploy Jerv Memory`) — there is
   no `runtime tenant redeploy` for these; re-run the repo's OWN declared `workflow_dispatch` deploy workflow at
   the promoted-equivalent ref: `gh workflow run <deploy-workflow> --repo {owner}/{repo} --ref <ref>`.
-- **hub-serverless** (MMI-Hub) — when `deploy.yml` fails the repo-index v4 readiness gate (`stale-commit` /
-  not-ready authorities), the promoted ref is fine; repair cloud v4 authorities first (#5405). List failing
-  authorities with `mmi-cli oracle repo-index status --cloud`, run
-  `mmi-cli oracle repo-index sync-estate --repo <owner/repo>` for each, re-probe with
-  `mmi-cli oracle repo-index health --live --queries-only`, then `gh run rerun --failed` on the failed
-  deploy run. Do not re-tag.
+- **hub-serverless** (MMI-Hub) — repair the named deploy failure, then rerun the failed deploy run. Do not re-tag.
 
 Name the sanctioned dispatch mechanism you used in the train report.
 
@@ -630,8 +625,9 @@ mmi-cli oracle org project sync-info --apply   # omit --apply for the read-only
   - `checkout restoration failed while returning to …` / `origin/<branch> fast-forward failed` — the
     checkout or the pull errored. Read the appended git message; the release is unaffected.
 
-  `--resume` prints no `checkout:` clause at all, so after a resumed release check `git branch
-  --show-current` rather than assuming you were moved back.
+  `--resume` uses the same `checkout:` clause after every branch-mutating terminal path. Direct-track
+  resumes return to `development`; full-track resumes return to `rc`. A skipped restoration names the
+  dirty tree, checkout failure, or fast-forward failure and still leaves the shipped release intact.
 
 ## Step 6 — collect deploy verdict + report
 

package/skills/repo-index-audit/SKILL.md

@@ -1,70 +0,0 @@
----
-name: repo-index-audit
-description: Audit repository indexing with live probes, receipts, and lexical/semantic/hybrid round-trips.
----
-
-# MMI repository-index estate audit
-
-Canonical counterpart to `jerv-memory-audit`. Each run verifies every layer live and proves every result with a receipt.
-
-**Vision:** MMI repository orientation works across the whole registered estate without anyone managing indexes by hand.
-
-**Mission:** End-to-end reliability audit **with remediation**. Verify every layer live, fix every approved in-scope defect, and prove each fix before closing it.
-
-## Start here
-
-1. Read shipped help before using a verb: `mmi-cli --help`, `mmi-cli explain oracle repo-index --json`, and `mmi-cli explain oracle find --json`.
-2. Read `docs/Guides/repo-index-runbook.md` and `docs/Architecture/compute-at-read.md` from the current MMI-Hub checkout.
-3. Create a dated receipt file in task-local ignored scratch. Record command, UTC time, exit code, and the bounded JSON fields that prove each verdict. Never record query text, source bodies, credentials, hostnames, vectors, or secrets.
-4. Treat `mmi-cli oracle repo-index status --cloud --json`, live health, and each result's retrieval metadata as runtime authority. Do not carry a recalled migration state into a new audit.
-
-## Layers — each needs a live probe this session, not a code read
-
-1. **Cloud backend health; full estate integrity** — run `mmi-cli oracle repo-index status --cloud --json`, `mmi-cli oracle repo-index health --live --json`, and `mmi-cli doctor --json`. PASS requires: endpoint reachable; registry roster present; active and ready authorities equal the roster; `nOfN` true; lexical, semantic, and hybrid readiness ready; citation validity and embedding coverage complete; no unaccounted integrity failure. Record the active provenance token and material layout reported now, never a hard-coded expected migration state.
-2. **`mmi-cli` command surface vs shipped help** — compare `mmi-cli commands --json` and `mmi-cli commands --all --json` with `mmi-cli oracle repo-index --help` and `mmi-cli explain` for `rebuild`, `publish`, `search`, `status`, `graph`, `health`, `gc`, `sync-estate`, and `oracle find`. Exercise `status`, `health`, `search`, and `find` as documented. PASS requires manifest, help, examples, and behavior to agree; agents can discover every supported verb and flag.
-3. **Guidance on every shipped surface** — verify the canonical `skills/onboard/SKILL.md`, `skills/mmi-resume/SKILL.md`, README, compute-at-read guide, and materialized plugin payloads carry the current rule: `oracle find` is semantic orientation, `oracle repo-index search` is hybrid orientation, cloud is default, `--local` is explicit checkout-only, and every hit is verified against repository, indexed commit, path, symbol, and lines. PASS requires `node scripts/check-skill-payload.mjs` to succeed.
-4. **Automated ingestion and fail-loud alarms** — run `mmi-cli harbour org schedules --json` and `gh run list --repo mutmutco/MMI-Hub --workflow repo-index-reconcile.yml --limit 20 --json databaseId,status,conclusion,createdAt,headSha`. Inspect the installed/current workflow for default-branch push dispatch plus Harbour reconcile dispatch. PASS requires: current successful push and scheduled receipts; the exact pushed commit is checked out; drift reconciliation is delta-first; failures emit a structured alarm and deduplicated board filing; no failure dies silently.
-5. **Build → lexical-search round-trip** — in an isolated clean checkout of one registered authority, choose a fresh unique marker already present at its current default-branch commit. Run `mmi-cli oracle repo-index rebuild --json`, then `mmi-cli oracle repo-index search "<marker>" --local --lexical --json`. Local `RepoIndexHit` owns only `repo`, `path`, `kind`, `why`, `score`, and optional `symbol` — it has no commit or line fields. PASS requires those local fields intact for the expected repository and path (and symbol when the hit is kind `symbol`), then verify commit and path directly against the isolated checkout (`git rev-parse HEAD` and that the cited path exists there). Then run `mmi-cli oracle repo-index search "<marker>" --cloud --lexical --json` for a unique marker at an active authority's reported commit; PASS requires the cloud commit-pinned citation (repository, commit, path, symbol, and lines). Never publish a canary commit without the execution handshake below.
-6. **Indexed material → semantic/hybrid round-trip** — choose a concept whose wording differs from the target symbol in an active authority. Run `mmi-cli oracle find "<concept>" --json`, `mmi-cli oracle repo-index search "<concept>" --cloud --semantic --json`, and default hybrid search with `mmi-cli oracle repo-index search "<concept>" --cloud --json`. PASS requires: semantic retrieval is used rather than silently claimed; hybrid reports its lexical and semantic retrieval/fallback metadata; citations resolve at the reported indexed commit; semantic and hybrid return a relevant cited target. A lexical fallback is evidence of degradation, not a semantic PASS.
-7. **Structural extraction and embeddings** — run the cloud status and live-health probes from layer 1 plus the semantic query from layer 6. Compare their current authority/retrieval metadata with the checked-in v4 schema, path policy, grammar lock, and embedder model lock. PASS requires: pinned grammar/model provenance; expected dimensions; normalized embedding coverage; typed degradation when query embedding is unavailable; successful live semantic inference; the designated local/self-hosted BGE lane; no metered LLM key or developer-laptop model path. Never print environment values; record presence/absence and provider metadata only.
-8. **Delta, layout, rollback, and reconciliation** — run `mmi-cli oracle repo-index sync-estate --plan --json`. PASS requires: no unexpected authority drift; current layout/provenance is explicit; unchanged authorities plan no rebuild; changed authorities are delta candidates where compatible; active pointers remain valid; rollback material is retained; no retired serving fallback is implied. After any separately approved rebuild or migration, require **successful snapshot verification**, not a second reconcile that is a no-op: the run completed against its chosen commits, published safely, left all authorities ready (N-of-N lexical, semantic, hybrid, and rollback verification), and recorded any later tip commits as normal next-cycle freshness work. Never FAIL or rerun solely to chase a globally motionless estate — product commits that land during or after the run are expected freshness, not failed reconciliation. Unchanged-authority rebuild idempotency is a separate defect track; do not conflate it with this gate.
-9. **Telemetry and schedules** — verify status query-usage rollups, readiness/shadow receipts, failure alarms, and `mmi-cli harbour org schedules --json`. PASS requires: query telemetry stores only allowlisted coarse caller/source labels; readiness stores hashes rather than query text; the reconcile schedule is present, enabled, recently firing, idempotent, and has no silent death. Zero ordinary query count is valid data but must be reported as zero adoption evidence, never as proof that search is exercised.
-
-## Round-trip rules
-
-- Use a different marker/query pair for lexical and semantic/hybrid probes.
-- Record retrieval mode, fallback/degraded reason, and every field the hit surface actually returns. Local hits: `repo`, `path`, `kind`, `why`, `score`, optional `symbol`, then confirm commit and path against the isolated checkout. Cloud hits: repository, indexed commit, path, symbol, and lines.
-- For cloud citations, verify cited files against the exact indexed commit, not a moving checkout HEAD. For local citations, verify path against the isolated checkout whose HEAD you just rebuilt.
-- Local rebuilds stay in disposable task scratch. Remove them after receipts are captured.
-- A cloud publish, full rebuild, migration, rollback activation, schedule dispatch, or production change is an external mutation. Stop and ask for explicit approval naming the repositories and effect before running it.
-
-## Rules
-
-- **Evidence-first** — nothing is healthy without a current receipt.
-- **Runtime-first** — live status and retrieval metadata outrank memory and static docs for current state.
-- Every defect gets a named cause, severity, and either an approved in-scope fix or a board filing on MMI-Hub.
-- Never weaken a test or accept lexical fallback as semantic success.
-- Use bounded receipts. Keep full raw output in task-local ignored scratch, not the report.
-
-## Done when
-
-- Every layer has PASS-with-receipt or a filed issue.
-- Both round-trips (build→lexical search and indexed material→semantic/hybrid search) are verified end to end.
-- Push ingestion and the scheduled reconcile each have current firing evidence.
-- Post-rebuild or migration layers close on successful snapshot verification (chosen-commit completion, safe publish, authorities ready), not on a motionless-estate / no-op second reconcile.
-- The dated estate summary records N/N layers, roster N-of-N, active provenance/layout, lexical/semantic/hybrid verdicts, adoption count, schedule state, defects, fixes, issue links, and receipt paths — including any post-snapshot tip commits noted as next-cycle freshness.
-- Save the durable summary in the owning MMI-Hub issue or audit artifact. Save only the settled cross-session lesson or handoff to JervCoding; never copy raw query or index material into memory.
-
-## Out of scope
-
-New index features; production mutation without approval; fresh secrets; storing source bodies, query text, vectors, credentials, or secret values in receipts.
-
-## House rules
-
-- Audit read-only by default. Inspection, local disposable rebuilds, and reporting are allowed; any cloud write or external dispatch needs a fresh execution handshake.
-- Repository fixes and board filings follow the standard issue, branch, worktree, PR, and `development` landing flow.
-
-## Retro — one check before you finish
-
-Before the final report, ask whether this skill's instructions misfired through ambiguous wording, a misleading message, or a missing environment warning. Process only, never the user's code or task. If yes, file one lesson and move on; a clean run is silent. The retro is advisory, so note a filing failure and continue:
-`mmi-cli learning skill-lesson --skill repo-index-audit --title "<what misfired>" --body "<what; evidence; proposed amendment>"`